This is how cyber attackers stole £2.26m from Tesco Bank customers

The inner workings of a cyber attack against Tesco Bank which saw £2.26m stolen from 9,000 customers -- and resulted in the bank being fined over £16.4m for the failings that allowed it to happen -- have been revealed.

The Financial Conduct Authority (FCA) has hit the bank with a £16.4m fine and said Tesco Bank failed to "exercise due skill, care and diligence" in protecting current account holders against a cyber attack.

The attack started at 02:00 on Saturday, 5 November 2016; by 04:00, Tesco Bank's fraud analysis and detection system started sending automatic text messages to the bank's personal current account holders asking them to call about "suspicious activity" on their accounts, which is how the bank itself first became aware of the attack.

The attackers most likely used an algorithm which generated authentic Tesco Bank debit card numbers and, using those virtual cards, they attempted to make thousands of unauthorised debit card transactions.

The FCA said Tesco Bank's failures include the way in which the bank distributed debit card numbers and mistakes made in the reaction to the attack which meant that no action was taken for almost a day after the incident was first uncovered.

Poor design of Tesco Bank debit cards played a significant role in creating security vulnerabilities that led to thousands of customers having their accounts emptied. One of these involved the PAN numbers -- the 16-digit card number sequence used to identify all debit cards.

Tesco Bank inadvertently issued debit cards with sequential PAN numbers. This increased the likelihood that the attackers would find the next PAN number in the sequence.

It took 21 hours after the attack began before Tesco Bank's Fraud Strategy Team was informed about the incident.

Only after what the FCA describes as a "series of errors" -- including Tesco Bank's Financial Crime Operations Team sending an email to the wrong address, instead of making a phone call as procedure requires -- was the fraud team made aware of the attack.

In all that time, nothing had been done to stop the attacks, with fraudulent transactions continuing to siphon money from accounts as the bank received more and more calls from worried customers.

It was only once the Fraud Strategy Team had finally been alerted that some headway was made into countering the attack. It was found that the vast majority of transactions were coming from Brazil and were using a payment method known as 'PoS 91' -- making transactions based on magnetic stripes that carry identifying information about the debit card.

This payment method is widely used outside of Europe and crucially doesn't limit the value or number of transactions -- and the number of successful attacks showed that the attackers had acquired the relevant PAN numbers.

Once PoS 91 was identified as the most frequently used channel for fraudulent transactions and Brazil as the location they were occurring, Tesco Bank's Fraud Strategy Team put a rule in place to block those transactions from 1:48am on Sunday 6th November -- almost a full 24 hours after the attack began.

But the trouble didn't end there: errors were made in the implementation of this rule which made it ineffective -- they used the Euro currency code instead of Brazil's country code -- and nobody noticed this until later.

As a result, the number of attempted transactions continued to rise, reaching 80,000 by Monday 7 November -- with Tesco Bank blocking 90 percent of these.

In an effort to counter this, Tesco Bank brought in external experts to uncover the problem in fraud detection systems that allowed these transactions to go through -- it turned out to be a coding error by Tesco Bank's Financial Crime Operations Team which had been made when it originally programmed the fraud detection system.

By the time this was discovered, it was almost two days after the fraudulent transactions started and customers had lost a combined total of £2.26m to cyber criminals.

Overall, the FCA found that Tesco Bank failed to exercise due skill, care and diligence to the design and distribution of debit cards, configuring specific authentication and fraud detection rules or when taking appropriate action to prevent the foreseeable risk of fraud.

The FCA also criticised Tesco Bank for failing to react to the incident with "sufficient rigour, skill and urgency".

In the aftermath of the attack, Tesco Bank is now said to have put a "comprehensive programme and significant resources into the issues which made it vulnerable to attack". However, when pressed on what these improvements are, Tesco Bank wouldn't give details.

While Brazil has been described as the potential location of those behind the attack, two years on there's still no information on who was behind the attack -- and no arrests have been made.

Thank You

By registering you become a member of the CBS Interactive family of sites and you have read and agree to the Terms of Use, Privacy Policy and Video Services Policy. You agree to receive updates, alerts and promotions from CBS and that CBS may share information about you with our marketing partners so that they may contact you by email or otherwise about their products or services.
You will also receive a complimentary subscription to the ZDNet's Tech Update Today and ZDNet Announcement newsletters. You may unsubscribe from these newsletters at any time.